Now officially on WordPress.org

CVE Database / CVE-2022-3881

CVE · Medium

CVE-2022-3881 — WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log [wptools] < 3.43 (closed)

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-3881 WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log [wptools] < 3.43 (closed) Cross-Site Request Forgery (CSRF) Medium 5.7 < 3.43 3.43 2022-11-18 —

CVE-2022-3881

The WP Tools plugin for WordPress versions up to 3.42 contains an authorization bypass vulnerability in the wptools_install_plugin() function that lacks proper capability verification. This flaw allows any authenticated user, including those with subscriber-level permissions, to install additional plugins created by the same developer without proper authorization checks. An attacker could exploit this to deploy other vulnerable plugins on the affected site to facilitate further attacks.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings